Hacking the Xbox

124
Hacking the Xbox: An Introduction to Reverse Engineering
What About Driving Signals onto
HyperTransport?
The eavesdropping application described in this chapter
only requires a HyperTransport receiver. Applications such
as “man-in-the-middle” attacks require a device that can
override HyperTransport signals and insert a false bit or two.
Such a device is feasible because HyperTransport, like LVDS,
uses current-mode drivers. In other words, the drivers are
designed to drive only a measured amount of current into
the wire, regardless of the voltage it creates. In a normal
situation, this works perfectly well because the impedance
of the wire transforms the current into a voltage in accordance
with Ohm’s Law. However, currents can sum and
cancel each other out. An antagonistic differential driver
that applies an overdrive current that cancels out the intended
signal can be attached to a HyperTransport line.
This kind of overdrive can be accomplished using the flexible,
programmable I/O provided in FPGAs such as the Xilinx
Virtex-E and Virtex II.
The simplest application of such a bus override device would
be one that modifies the destination of the reset vector as
it is transmitted to the CPU, enabling you to gain control of
the Xbox. The reset vector destination is coded into a single
byte that follows the “jump” opcode located at 0xFFFF.FFF0.
The reset vector is likely transmitted a deterministic number
of clocks from the de-activation of reset, so the timing element
for this attack can consist of just a timer that is clocked
by the HyperTransport bus clock and synchronized to a
reset signal. A “man-in-the-middle” attack like this will defeat
even a cryptographically secure public-key boot block
implementation.
here. In addition, the LVDS receiver must be located very close to the
Xbox motherboard in order to not corrupt the target signals. A long
cable would dissipate energy out of the wires and introduce noise and
reflections that might cause the system to cease functioning.
The solution to the problem of getting the HyperTransport signals to the
FPGA is to use a signal conversion chip. LVDS is a popular standard for
LCD panel interfaces and backplanes used in telecomm systems, so numerous
inexpensive LVDS-to-CMOS converters are available. Of course, the
desired signaling convention is CTT, but a closer look reveals that interfacing
CMOS drivers to CTT receivers is actually not a problem. CTT is a currentmode
signaling convention that drives +8 mA or -8 mA into a 50 ohm
transmission line terminated at 1.5 volts. The receiver is a differential
amplifier that compares the reference termination voltage with the transmission
line voltage. In the Virtex-E, a CTT receiver amplifier is specified to
work as long as the received voltage swings more than 200 mV up or down
from the reference voltage. Most CMOS transmitters driving a CTT
terminated line will have no problem sourcing or sinking 8 mA of current